Napalys
|
a0df33c3ac
|
JS: UnsafeShellCommand Using unknown flags in the RegExp object is no longer flagged as bad sanitization to reduce false positives.
|
2024-11-28 11:26:43 +01:00 |
|
Napalys
|
155f1fca85
|
JS: Added test cases for unsafe shell command sanitization with RegExpr Object, instead of literal
|
2024-11-28 11:26:42 +01:00 |
|
Napalys
|
23b18aeca9
|
JS: Now unknown flags are not flagged in taint paths
|
2024-11-28 11:26:41 +01:00 |
|
Napalys
|
7db6f7c721
|
JS: Added test cases with new RegExp for Tainted paths, currently works only with literals
|
2024-11-28 11:26:39 +01:00 |
|
Napalys
|
faef9dd877
|
JS: protyte poluting now treats unknownFlags as potentially good sanitization.
|
2024-11-28 11:26:38 +01:00 |
|
Napalys
|
41fef0f2b3
|
JS: Added test cases which cover new RegExp creation with replace on protytpe pulluting
|
2024-11-28 11:26:37 +01:00 |
|
Napalys
|
18c7b18f82
|
JS: Now BadHtmlSanitizers new RegExp with unknown flags is also flagged.
|
2024-11-28 11:26:36 +01:00 |
|
Napalys
|
89f3b6f8d3
|
JS: Added test case for bad sanitizer with unknown flags, currently not flagged.
|
2024-11-28 11:26:35 +01:00 |
|
Napalys
|
38be0e4c0a
|
JS: Now BadHtmlSanitizers also flags new RegExp as potential issue
|
2024-11-28 11:26:34 +01:00 |
|
Napalys
|
41f21d429b
|
JS: Added test case which is not flagged but should be abusing new RegExp with global flag
|
2024-11-28 11:26:33 +01:00 |
|
Asger F
|
805fd0b46e
|
JS: Refine speculative step definition
|
2024-11-26 15:56:56 +01:00 |
|
Asger F
|
8818fcc207
|
JS: Benign test output changes
|
2024-11-26 15:47:13 +01:00 |
|
Asger F
|
82d61e4194
|
Merge branch 'js/shared-dataflow-branch' into js/shared-dataflow-merge-main
|
2024-11-26 15:36:16 +01:00 |
|
Asger F
|
f073f3b791
|
JS: Rename file to foo.test.js
|
2024-11-26 13:44:00 +01:00 |
|
Asger F
|
65da9b41b5
|
JS: Add cross-file test in InsecureRandom
|
2024-11-26 13:43:24 +01:00 |
|
Asger F
|
b4bd8e701c
|
JS: Add test for file classification change
|
2024-11-26 12:33:39 +01:00 |
|
Napalys Klicius
|
e9dff4d68f
|
Merge pull request #17953 from Napalys/napalys/ts57
JS: upgrade TypeScript to 5.7
|
2024-11-25 14:16:40 +01:00 |
|
Napalys Klicius
|
d6372aebc7
|
Update javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
|
2024-11-25 12:12:12 +01:00 |
|
Napalys
|
e38b63ebcd
|
JS: previously js/case-sensitive-middleware-path was not taking into consideration unknown flags
|
2024-11-25 11:56:06 +01:00 |
|
Napalys
|
178da21fb8
|
JS: Added test case for CWE-178 RegExp with unknown flags
|
2024-11-25 11:53:00 +01:00 |
|
Napalys Klicius
|
61e00861e5
|
Merge pull request #18008 from Napalys/napalys/ES2024-group-functions
JS: Added support for [Object, Map].groupBy ES2024 feature
|
2024-11-21 19:03:57 +01:00 |
|
Napalys Klicius
|
edb9b47111
|
Merge pull request #18047 from Napalys/napalys/ES2023-string-protytpe-toWellFormed
JS: Added taint-step String.prototype.toWellFormed ES2023 feature
|
2024-11-21 14:01:21 +01:00 |
|
Asger F
|
930a7b6e28
|
JS: Update output changes to nodes/edges/subpaths
|
2024-11-21 13:33:39 +01:00 |
|
Asger F
|
7a77432024
|
JS: Update lost result in insecure-download
The VariableCapture library consumes one component of the access path limit, which means we lose this result
|
2024-11-21 13:33:10 +01:00 |
|
Asger F
|
1ac7591faf
|
JS: Update missed flow in capture-flow.js
We previously caught this flow because of a heuristic in capture flow. We'll have to fix it properly later.
|
2024-11-21 12:57:34 +01:00 |
|
Asger F
|
84820adf3c
|
Add test for exception flow out of finally()
|
2024-11-21 11:01:03 +01:00 |
|
Asger F
|
948d21ca07
|
JS: Propagate exceptions from summarized callables by default
|
2024-11-21 10:24:31 +01:00 |
|
Asger F
|
dcdb2e5133
|
JS: Fix callback check so it works without parameters
|
2024-11-21 10:24:29 +01:00 |
|
Asger F
|
b7dd455aff
|
JS: Add test case
|
2024-11-21 09:21:36 +01:00 |
|
Napalys
|
afc2d3e6d2
|
JS: Add: String.protytpe.toWellFormed to StringManipulationTaintStep
|
2024-11-20 17:42:25 +01:00 |
|
Napalys
|
09f73d8d6f
|
JS: Add: test cases for toWellFormed
|
2024-11-20 17:36:43 +01:00 |
|
Asger F
|
d52bc971b8
|
Merge branch 'main' into js/shared-dataflow-merge-main
|
2024-11-20 14:05:03 +01:00 |
|
Napalys Klicius
|
a957e00fe5
|
Merge branch 'main' into napalys/ES2024-group-functions
|
2024-11-20 14:03:31 +01:00 |
|
Napalys
|
58faa2d71e
|
JS: Add: dataflow step for static method of groupBy from Map.
|
2024-11-20 13:34:11 +01:00 |
|
Napalys
|
6344f83e4b
|
JS: Add: tests for taint tracking in groupBy functions
|
2024-11-20 13:22:53 +01:00 |
|
Napalys
|
28ead4011a
|
JS: Add: taint step to handle propagation of data flow from the array to callback
|
2024-11-19 14:15:15 +01:00 |
|
Napalys
|
f1e95a8a1d
|
JS: Add: taint step test cases for findLastIndex, findLast, find
|
2024-11-19 14:09:58 +01:00 |
|
Asger F
|
80a5a5909e
|
JS: Use getUnderlyingValue() a few places in VariableCapture
|
2024-11-19 13:23:29 +01:00 |
|
Asger F
|
d2daec4c66
|
JS: Add tests explaining why the IIFE in f2 didn't work
|
2024-11-19 13:23:24 +01:00 |
|
Napalys
|
c03d69af1e
|
JS: Add: dataflow step for find, findLast, findLastIndex callback functions
|
2024-11-19 09:42:11 +01:00 |
|
Napalys
|
b64b837db3
|
JS: Add: test cases for find, findLast, findLastIndex with callbacks
|
2024-11-19 09:35:43 +01:00 |
|
Asger F
|
37676f41aa
|
JS: Remove jump steps from IIFE steps
|
2024-11-18 13:38:34 +01:00 |
|
Asger F
|
7f2eae0966
|
JS: Add test case for false flow through IIFEs
We generate local flow steps into and out of IIFEs, but these come jump steps automatically, resulting in FPs.
|
2024-11-18 13:34:35 +01:00 |
|
Asger F
|
7acc5689cf
|
JS: Port exception steps to a universal summary
|
2024-11-18 13:27:58 +01:00 |
|
Asger F
|
5ed362f7d6
|
JS: Add exception test case
|
2024-11-18 13:23:09 +01:00 |
|
Napalys
|
213ce225e0
|
JS: Add: taint step for Object.groupBy function, fixed test cases from 8ae05d8be4
|
2024-11-18 12:58:07 +01:00 |
|
Napalys
|
8ae05d8be4
|
JS: Add: test case for Object.groupBy
|
2024-11-18 12:55:17 +01:00 |
|
Napalys
|
c02ad65fdc
|
JS: Add: taint step for Map.groupBy function
|
2024-11-18 12:50:06 +01:00 |
|
Napalys
|
3786ad4277
|
JS: Add: test case for Map.groupBy
|
2024-11-18 12:44:49 +01:00 |
|
Napalys
|
a28fc8e772
|
JS: Add: Use of returnless function support for findLast and findLastIndex
|
2024-11-15 14:44:25 +01:00 |
|